Vulnerability Exchange: One Domain Account for More Than Exchange Server
Tianze Ding demonstrates chaining Microsoft Exchange vulnerabilities with Active Directory trusts, escalating a low-privilege domain user to full Domain Admin.
Summary
Microsoft Exchange as a Pivot Point in Active Directory
Because Microsoft Exchange Server requires extensive Active Directory schema extensions and service accounts, compromising an Exchange server often provides pathways to full domain control.
Auditing Exchange Protocol Handlers and EWS Endpoints
Tianze Ding analyzes Exchange Web Services (EWS), RPC over HTTP, and Outlook Web App (OWA), discovering privilege delegation weaknesses in Kerberos authentication.
Chaining Flaws from Low-Privilege Domain User to Domain Admin
Using a single unprivileged domain credential, an attacker exploits Exchange impersonation rights and ACL misconfigurations to execute arbitrary commands as SYSTEM across domain controllers.
Hardening Active Directory and Exchange Deployments
Ding outlines detection strategies for anomalous EWS API calls and advises administrators on least-privilege delegation for Exchange service accounts.
Related talks
Password Village·13 min
EvilMog
Demonstrates pivoting from compromised networked printers into Active Directory environments to forge Kerberos silver tickets.
Password Village·12 min
EvilMog
Walks through exploiting embedded printer credentials to pivot across domain infrastructure and mint silver tickets.
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.